16d49e1aeSJan Lentfer /*
26d49e1aeSJan Lentfer * EAP peer method: EAP-TLS (RFC 2716)
3*a1157835SDaniel Fojt * Copyright (c) 2004-2008, 2012-2015, Jouni Malinen <j@w1.fi>
46d49e1aeSJan Lentfer *
53ff40c12SJohn Marino * This software may be distributed under the terms of the BSD license.
63ff40c12SJohn Marino * See README for more details.
76d49e1aeSJan Lentfer */
86d49e1aeSJan Lentfer
96d49e1aeSJan Lentfer #include "includes.h"
106d49e1aeSJan Lentfer
116d49e1aeSJan Lentfer #include "common.h"
123ff40c12SJohn Marino #include "crypto/tls.h"
136d49e1aeSJan Lentfer #include "eap_i.h"
146d49e1aeSJan Lentfer #include "eap_tls_common.h"
156d49e1aeSJan Lentfer #include "eap_config.h"
166d49e1aeSJan Lentfer
176d49e1aeSJan Lentfer
186d49e1aeSJan Lentfer static void eap_tls_deinit(struct eap_sm *sm, void *priv);
196d49e1aeSJan Lentfer
206d49e1aeSJan Lentfer
216d49e1aeSJan Lentfer struct eap_tls_data {
226d49e1aeSJan Lentfer struct eap_ssl_data ssl;
236d49e1aeSJan Lentfer u8 *key_data;
243ff40c12SJohn Marino u8 *session_id;
253ff40c12SJohn Marino size_t id_len;
263ff40c12SJohn Marino void *ssl_ctx;
273ff40c12SJohn Marino u8 eap_type;
28*a1157835SDaniel Fojt struct wpabuf *pending_resp;
296d49e1aeSJan Lentfer };
306d49e1aeSJan Lentfer
316d49e1aeSJan Lentfer
eap_tls_init(struct eap_sm * sm)326d49e1aeSJan Lentfer static void * eap_tls_init(struct eap_sm *sm)
336d49e1aeSJan Lentfer {
346d49e1aeSJan Lentfer struct eap_tls_data *data;
356d49e1aeSJan Lentfer struct eap_peer_config *config = eap_get_config(sm);
366d49e1aeSJan Lentfer if (config == NULL ||
376d49e1aeSJan Lentfer ((sm->init_phase2 ? config->private_key2 : config->private_key)
386d49e1aeSJan Lentfer == NULL &&
396d49e1aeSJan Lentfer (sm->init_phase2 ? config->engine2 : config->engine) == 0)) {
406d49e1aeSJan Lentfer wpa_printf(MSG_INFO, "EAP-TLS: Private key not configured");
416d49e1aeSJan Lentfer return NULL;
426d49e1aeSJan Lentfer }
436d49e1aeSJan Lentfer
446d49e1aeSJan Lentfer data = os_zalloc(sizeof(*data));
456d49e1aeSJan Lentfer if (data == NULL)
466d49e1aeSJan Lentfer return NULL;
476d49e1aeSJan Lentfer
483ff40c12SJohn Marino data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
493ff40c12SJohn Marino sm->ssl_ctx;
503ff40c12SJohn Marino
513ff40c12SJohn Marino if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TLS)) {
526d49e1aeSJan Lentfer wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
536d49e1aeSJan Lentfer eap_tls_deinit(sm, data);
546d49e1aeSJan Lentfer if (config->engine) {
556d49e1aeSJan Lentfer wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting Smartcard "
566d49e1aeSJan Lentfer "PIN");
576d49e1aeSJan Lentfer eap_sm_request_pin(sm);
586d49e1aeSJan Lentfer sm->ignore = TRUE;
596d49e1aeSJan Lentfer } else if (config->private_key && !config->private_key_passwd)
606d49e1aeSJan Lentfer {
616d49e1aeSJan Lentfer wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting private "
626d49e1aeSJan Lentfer "key passphrase");
636d49e1aeSJan Lentfer eap_sm_request_passphrase(sm);
646d49e1aeSJan Lentfer sm->ignore = TRUE;
656d49e1aeSJan Lentfer }
666d49e1aeSJan Lentfer return NULL;
676d49e1aeSJan Lentfer }
686d49e1aeSJan Lentfer
693ff40c12SJohn Marino data->eap_type = EAP_TYPE_TLS;
703ff40c12SJohn Marino
716d49e1aeSJan Lentfer return data;
726d49e1aeSJan Lentfer }
736d49e1aeSJan Lentfer
746d49e1aeSJan Lentfer
753ff40c12SJohn Marino #ifdef EAP_UNAUTH_TLS
eap_unauth_tls_init(struct eap_sm * sm)763ff40c12SJohn Marino static void * eap_unauth_tls_init(struct eap_sm *sm)
773ff40c12SJohn Marino {
783ff40c12SJohn Marino struct eap_tls_data *data;
793ff40c12SJohn Marino struct eap_peer_config *config = eap_get_config(sm);
803ff40c12SJohn Marino
813ff40c12SJohn Marino data = os_zalloc(sizeof(*data));
823ff40c12SJohn Marino if (data == NULL)
833ff40c12SJohn Marino return NULL;
843ff40c12SJohn Marino
853ff40c12SJohn Marino data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
863ff40c12SJohn Marino sm->ssl_ctx;
873ff40c12SJohn Marino
883ff40c12SJohn Marino if (eap_peer_tls_ssl_init(sm, &data->ssl, config,
893ff40c12SJohn Marino EAP_UNAUTH_TLS_TYPE)) {
903ff40c12SJohn Marino wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
913ff40c12SJohn Marino eap_tls_deinit(sm, data);
923ff40c12SJohn Marino return NULL;
933ff40c12SJohn Marino }
943ff40c12SJohn Marino
953ff40c12SJohn Marino data->eap_type = EAP_UNAUTH_TLS_TYPE;
963ff40c12SJohn Marino
973ff40c12SJohn Marino return data;
983ff40c12SJohn Marino }
993ff40c12SJohn Marino #endif /* EAP_UNAUTH_TLS */
1003ff40c12SJohn Marino
1013ff40c12SJohn Marino
102*a1157835SDaniel Fojt #ifdef CONFIG_HS20
eap_wfa_unauth_tls_init(struct eap_sm * sm)103*a1157835SDaniel Fojt static void * eap_wfa_unauth_tls_init(struct eap_sm *sm)
104*a1157835SDaniel Fojt {
105*a1157835SDaniel Fojt struct eap_tls_data *data;
106*a1157835SDaniel Fojt struct eap_peer_config *config = eap_get_config(sm);
107*a1157835SDaniel Fojt
108*a1157835SDaniel Fojt data = os_zalloc(sizeof(*data));
109*a1157835SDaniel Fojt if (data == NULL)
110*a1157835SDaniel Fojt return NULL;
111*a1157835SDaniel Fojt
112*a1157835SDaniel Fojt data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
113*a1157835SDaniel Fojt sm->ssl_ctx;
114*a1157835SDaniel Fojt
115*a1157835SDaniel Fojt if (eap_peer_tls_ssl_init(sm, &data->ssl, config,
116*a1157835SDaniel Fojt EAP_WFA_UNAUTH_TLS_TYPE)) {
117*a1157835SDaniel Fojt wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
118*a1157835SDaniel Fojt eap_tls_deinit(sm, data);
119*a1157835SDaniel Fojt return NULL;
120*a1157835SDaniel Fojt }
121*a1157835SDaniel Fojt
122*a1157835SDaniel Fojt data->eap_type = EAP_WFA_UNAUTH_TLS_TYPE;
123*a1157835SDaniel Fojt
124*a1157835SDaniel Fojt return data;
125*a1157835SDaniel Fojt }
126*a1157835SDaniel Fojt #endif /* CONFIG_HS20 */
127*a1157835SDaniel Fojt
128*a1157835SDaniel Fojt
eap_tls_free_key(struct eap_tls_data * data)129*a1157835SDaniel Fojt static void eap_tls_free_key(struct eap_tls_data *data)
130*a1157835SDaniel Fojt {
131*a1157835SDaniel Fojt if (data->key_data) {
132*a1157835SDaniel Fojt bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
133*a1157835SDaniel Fojt data->key_data = NULL;
134*a1157835SDaniel Fojt }
135*a1157835SDaniel Fojt }
136*a1157835SDaniel Fojt
137*a1157835SDaniel Fojt
eap_tls_deinit(struct eap_sm * sm,void * priv)1386d49e1aeSJan Lentfer static void eap_tls_deinit(struct eap_sm *sm, void *priv)
1396d49e1aeSJan Lentfer {
1406d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
1416d49e1aeSJan Lentfer if (data == NULL)
1426d49e1aeSJan Lentfer return;
1436d49e1aeSJan Lentfer eap_peer_tls_ssl_deinit(sm, &data->ssl);
144*a1157835SDaniel Fojt eap_tls_free_key(data);
1453ff40c12SJohn Marino os_free(data->session_id);
146*a1157835SDaniel Fojt wpabuf_free(data->pending_resp);
1476d49e1aeSJan Lentfer os_free(data);
1486d49e1aeSJan Lentfer }
1496d49e1aeSJan Lentfer
1506d49e1aeSJan Lentfer
eap_tls_failure(struct eap_sm * sm,struct eap_tls_data * data,struct eap_method_ret * ret,int res,struct wpabuf * resp,u8 id)1516d49e1aeSJan Lentfer static struct wpabuf * eap_tls_failure(struct eap_sm *sm,
1526d49e1aeSJan Lentfer struct eap_tls_data *data,
1536d49e1aeSJan Lentfer struct eap_method_ret *ret, int res,
1546d49e1aeSJan Lentfer struct wpabuf *resp, u8 id)
1556d49e1aeSJan Lentfer {
1566d49e1aeSJan Lentfer wpa_printf(MSG_DEBUG, "EAP-TLS: TLS processing failed");
1576d49e1aeSJan Lentfer
1586d49e1aeSJan Lentfer ret->methodState = METHOD_DONE;
1596d49e1aeSJan Lentfer ret->decision = DECISION_FAIL;
1606d49e1aeSJan Lentfer
1616d49e1aeSJan Lentfer if (resp) {
1626d49e1aeSJan Lentfer /*
1636d49e1aeSJan Lentfer * This is likely an alert message, so send it instead of just
1646d49e1aeSJan Lentfer * ACKing the error.
1656d49e1aeSJan Lentfer */
1666d49e1aeSJan Lentfer return resp;
1676d49e1aeSJan Lentfer }
1686d49e1aeSJan Lentfer
1693ff40c12SJohn Marino return eap_peer_tls_build_ack(id, data->eap_type, 0);
1706d49e1aeSJan Lentfer }
1716d49e1aeSJan Lentfer
1726d49e1aeSJan Lentfer
eap_tls_success(struct eap_sm * sm,struct eap_tls_data * data,struct eap_method_ret * ret)1736d49e1aeSJan Lentfer static void eap_tls_success(struct eap_sm *sm, struct eap_tls_data *data,
1746d49e1aeSJan Lentfer struct eap_method_ret *ret)
1756d49e1aeSJan Lentfer {
176*a1157835SDaniel Fojt const char *label;
177*a1157835SDaniel Fojt const u8 eap_tls13_context[] = { EAP_TYPE_TLS };
178*a1157835SDaniel Fojt const u8 *context = NULL;
179*a1157835SDaniel Fojt size_t context_len = 0;
180*a1157835SDaniel Fojt
1816d49e1aeSJan Lentfer wpa_printf(MSG_DEBUG, "EAP-TLS: Done");
1826d49e1aeSJan Lentfer
183*a1157835SDaniel Fojt if (data->ssl.tls_out) {
184*a1157835SDaniel Fojt wpa_printf(MSG_DEBUG, "EAP-TLS: Fragment(s) remaining");
185*a1157835SDaniel Fojt return;
186*a1157835SDaniel Fojt }
187*a1157835SDaniel Fojt
188*a1157835SDaniel Fojt if (data->ssl.tls_v13) {
189*a1157835SDaniel Fojt label = "EXPORTER_EAP_TLS_Key_Material";
190*a1157835SDaniel Fojt context = eap_tls13_context;
191*a1157835SDaniel Fojt context_len = 1;
192*a1157835SDaniel Fojt
193*a1157835SDaniel Fojt /* A possible NewSessionTicket may be received before
194*a1157835SDaniel Fojt * EAP-Success, so need to allow it to be received. */
195*a1157835SDaniel Fojt ret->methodState = METHOD_MAY_CONT;
196*a1157835SDaniel Fojt ret->decision = DECISION_COND_SUCC;
197*a1157835SDaniel Fojt } else {
198*a1157835SDaniel Fojt label = "client EAP encryption";
199*a1157835SDaniel Fojt
2006d49e1aeSJan Lentfer ret->methodState = METHOD_DONE;
2016d49e1aeSJan Lentfer ret->decision = DECISION_UNCOND_SUCC;
202*a1157835SDaniel Fojt }
2036d49e1aeSJan Lentfer
204*a1157835SDaniel Fojt eap_tls_free_key(data);
205*a1157835SDaniel Fojt data->key_data = eap_peer_tls_derive_key(sm, &data->ssl, label,
206*a1157835SDaniel Fojt context, context_len,
2076d49e1aeSJan Lentfer EAP_TLS_KEY_LEN +
2086d49e1aeSJan Lentfer EAP_EMSK_LEN);
2096d49e1aeSJan Lentfer if (data->key_data) {
2106d49e1aeSJan Lentfer wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived key",
2116d49e1aeSJan Lentfer data->key_data, EAP_TLS_KEY_LEN);
2126d49e1aeSJan Lentfer wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived EMSK",
2136d49e1aeSJan Lentfer data->key_data + EAP_TLS_KEY_LEN,
2146d49e1aeSJan Lentfer EAP_EMSK_LEN);
2156d49e1aeSJan Lentfer } else {
2166d49e1aeSJan Lentfer wpa_printf(MSG_INFO, "EAP-TLS: Failed to derive key");
2176d49e1aeSJan Lentfer }
2183ff40c12SJohn Marino
2193ff40c12SJohn Marino os_free(data->session_id);
2203ff40c12SJohn Marino data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl,
2213ff40c12SJohn Marino EAP_TYPE_TLS,
2223ff40c12SJohn Marino &data->id_len);
2233ff40c12SJohn Marino if (data->session_id) {
2243ff40c12SJohn Marino wpa_hexdump(MSG_DEBUG, "EAP-TLS: Derived Session-Id",
2253ff40c12SJohn Marino data->session_id, data->id_len);
2263ff40c12SJohn Marino } else {
2273ff40c12SJohn Marino wpa_printf(MSG_ERROR, "EAP-TLS: Failed to derive Session-Id");
2283ff40c12SJohn Marino }
2296d49e1aeSJan Lentfer }
2306d49e1aeSJan Lentfer
2316d49e1aeSJan Lentfer
eap_tls_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)2326d49e1aeSJan Lentfer static struct wpabuf * eap_tls_process(struct eap_sm *sm, void *priv,
2336d49e1aeSJan Lentfer struct eap_method_ret *ret,
2346d49e1aeSJan Lentfer const struct wpabuf *reqData)
2356d49e1aeSJan Lentfer {
2366d49e1aeSJan Lentfer size_t left;
2376d49e1aeSJan Lentfer int res;
2386d49e1aeSJan Lentfer struct wpabuf *resp;
2396d49e1aeSJan Lentfer u8 flags, id;
2406d49e1aeSJan Lentfer const u8 *pos;
2416d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
242*a1157835SDaniel Fojt struct wpabuf msg;
243*a1157835SDaniel Fojt
244*a1157835SDaniel Fojt if (sm->waiting_ext_cert_check && data->pending_resp) {
245*a1157835SDaniel Fojt struct eap_peer_config *config = eap_get_config(sm);
246*a1157835SDaniel Fojt
247*a1157835SDaniel Fojt if (config->pending_ext_cert_check == EXT_CERT_CHECK_GOOD) {
248*a1157835SDaniel Fojt wpa_printf(MSG_DEBUG,
249*a1157835SDaniel Fojt "EAP-TLS: External certificate check succeeded - continue handshake");
250*a1157835SDaniel Fojt resp = data->pending_resp;
251*a1157835SDaniel Fojt data->pending_resp = NULL;
252*a1157835SDaniel Fojt sm->waiting_ext_cert_check = 0;
253*a1157835SDaniel Fojt return resp;
254*a1157835SDaniel Fojt }
255*a1157835SDaniel Fojt
256*a1157835SDaniel Fojt if (config->pending_ext_cert_check == EXT_CERT_CHECK_BAD) {
257*a1157835SDaniel Fojt wpa_printf(MSG_DEBUG,
258*a1157835SDaniel Fojt "EAP-TLS: External certificate check failed - force authentication failure");
259*a1157835SDaniel Fojt ret->methodState = METHOD_DONE;
260*a1157835SDaniel Fojt ret->decision = DECISION_FAIL;
261*a1157835SDaniel Fojt sm->waiting_ext_cert_check = 0;
262*a1157835SDaniel Fojt return NULL;
263*a1157835SDaniel Fojt }
264*a1157835SDaniel Fojt
265*a1157835SDaniel Fojt wpa_printf(MSG_DEBUG,
266*a1157835SDaniel Fojt "EAP-TLS: Continuing to wait external server certificate validation");
267*a1157835SDaniel Fojt return NULL;
268*a1157835SDaniel Fojt }
2696d49e1aeSJan Lentfer
2703ff40c12SJohn Marino pos = eap_peer_tls_process_init(sm, &data->ssl, data->eap_type, ret,
2716d49e1aeSJan Lentfer reqData, &left, &flags);
2726d49e1aeSJan Lentfer if (pos == NULL)
2736d49e1aeSJan Lentfer return NULL;
2746d49e1aeSJan Lentfer id = eap_get_id(reqData);
2756d49e1aeSJan Lentfer
2766d49e1aeSJan Lentfer if (flags & EAP_TLS_FLAGS_START) {
2776d49e1aeSJan Lentfer wpa_printf(MSG_DEBUG, "EAP-TLS: Start");
2786d49e1aeSJan Lentfer left = 0; /* make sure that this frame is empty, even though it
2796d49e1aeSJan Lentfer * should always be, anyway */
2806d49e1aeSJan Lentfer }
2816d49e1aeSJan Lentfer
2826d49e1aeSJan Lentfer resp = NULL;
283*a1157835SDaniel Fojt wpabuf_set(&msg, pos, left);
2843ff40c12SJohn Marino res = eap_peer_tls_process_helper(sm, &data->ssl, data->eap_type, 0,
285*a1157835SDaniel Fojt id, &msg, &resp);
2866d49e1aeSJan Lentfer
2876d49e1aeSJan Lentfer if (res < 0) {
2886d49e1aeSJan Lentfer return eap_tls_failure(sm, data, ret, res, resp, id);
2896d49e1aeSJan Lentfer }
2906d49e1aeSJan Lentfer
291*a1157835SDaniel Fojt if (sm->waiting_ext_cert_check) {
292*a1157835SDaniel Fojt wpa_printf(MSG_DEBUG,
293*a1157835SDaniel Fojt "EAP-TLS: Waiting external server certificate validation");
294*a1157835SDaniel Fojt wpabuf_free(data->pending_resp);
295*a1157835SDaniel Fojt data->pending_resp = resp;
296*a1157835SDaniel Fojt return NULL;
297*a1157835SDaniel Fojt }
298*a1157835SDaniel Fojt
299*a1157835SDaniel Fojt if (res == 2) {
300*a1157835SDaniel Fojt /* Application data included in the handshake message (used by
301*a1157835SDaniel Fojt * EAP-TLS 1.3 to indicate conclusion of the exchange). */
302*a1157835SDaniel Fojt wpa_hexdump_buf(MSG_DEBUG, "EAP-TLS: Received Application Data",
303*a1157835SDaniel Fojt resp);
304*a1157835SDaniel Fojt wpa_hexdump_buf(MSG_DEBUG, "EAP-TLS: Remaining tls_out data",
305*a1157835SDaniel Fojt data->ssl.tls_out);
306*a1157835SDaniel Fojt eap_peer_tls_reset_output(&data->ssl);
307*a1157835SDaniel Fojt /* Send an ACK to allow the server to complete exchange */
308*a1157835SDaniel Fojt res = 1;
309*a1157835SDaniel Fojt }
310*a1157835SDaniel Fojt
3113ff40c12SJohn Marino if (tls_connection_established(data->ssl_ctx, data->ssl.conn))
3126d49e1aeSJan Lentfer eap_tls_success(sm, data, ret);
3136d49e1aeSJan Lentfer
3146d49e1aeSJan Lentfer if (res == 1) {
3156d49e1aeSJan Lentfer wpabuf_free(resp);
3163ff40c12SJohn Marino return eap_peer_tls_build_ack(id, data->eap_type, 0);
3176d49e1aeSJan Lentfer }
3186d49e1aeSJan Lentfer
3196d49e1aeSJan Lentfer return resp;
3206d49e1aeSJan Lentfer }
3216d49e1aeSJan Lentfer
3226d49e1aeSJan Lentfer
eap_tls_has_reauth_data(struct eap_sm * sm,void * priv)3236d49e1aeSJan Lentfer static Boolean eap_tls_has_reauth_data(struct eap_sm *sm, void *priv)
3246d49e1aeSJan Lentfer {
3256d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
3263ff40c12SJohn Marino return tls_connection_established(data->ssl_ctx, data->ssl.conn);
3276d49e1aeSJan Lentfer }
3286d49e1aeSJan Lentfer
3296d49e1aeSJan Lentfer
eap_tls_deinit_for_reauth(struct eap_sm * sm,void * priv)3306d49e1aeSJan Lentfer static void eap_tls_deinit_for_reauth(struct eap_sm *sm, void *priv)
3316d49e1aeSJan Lentfer {
332*a1157835SDaniel Fojt struct eap_tls_data *data = priv;
333*a1157835SDaniel Fojt
334*a1157835SDaniel Fojt wpabuf_free(data->pending_resp);
335*a1157835SDaniel Fojt data->pending_resp = NULL;
3366d49e1aeSJan Lentfer }
3376d49e1aeSJan Lentfer
3386d49e1aeSJan Lentfer
eap_tls_init_for_reauth(struct eap_sm * sm,void * priv)3396d49e1aeSJan Lentfer static void * eap_tls_init_for_reauth(struct eap_sm *sm, void *priv)
3406d49e1aeSJan Lentfer {
3416d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
342*a1157835SDaniel Fojt eap_tls_free_key(data);
3433ff40c12SJohn Marino os_free(data->session_id);
3443ff40c12SJohn Marino data->session_id = NULL;
3456d49e1aeSJan Lentfer if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
3466d49e1aeSJan Lentfer os_free(data);
3476d49e1aeSJan Lentfer return NULL;
3486d49e1aeSJan Lentfer }
3496d49e1aeSJan Lentfer return priv;
3506d49e1aeSJan Lentfer }
3516d49e1aeSJan Lentfer
3526d49e1aeSJan Lentfer
eap_tls_get_status(struct eap_sm * sm,void * priv,char * buf,size_t buflen,int verbose)3536d49e1aeSJan Lentfer static int eap_tls_get_status(struct eap_sm *sm, void *priv, char *buf,
3546d49e1aeSJan Lentfer size_t buflen, int verbose)
3556d49e1aeSJan Lentfer {
3566d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
3576d49e1aeSJan Lentfer return eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
3586d49e1aeSJan Lentfer }
3596d49e1aeSJan Lentfer
3606d49e1aeSJan Lentfer
eap_tls_isKeyAvailable(struct eap_sm * sm,void * priv)3616d49e1aeSJan Lentfer static Boolean eap_tls_isKeyAvailable(struct eap_sm *sm, void *priv)
3626d49e1aeSJan Lentfer {
3636d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
3646d49e1aeSJan Lentfer return data->key_data != NULL;
3656d49e1aeSJan Lentfer }
3666d49e1aeSJan Lentfer
3676d49e1aeSJan Lentfer
eap_tls_getKey(struct eap_sm * sm,void * priv,size_t * len)3686d49e1aeSJan Lentfer static u8 * eap_tls_getKey(struct eap_sm *sm, void *priv, size_t *len)
3696d49e1aeSJan Lentfer {
3706d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
3716d49e1aeSJan Lentfer u8 *key;
3726d49e1aeSJan Lentfer
3736d49e1aeSJan Lentfer if (data->key_data == NULL)
3746d49e1aeSJan Lentfer return NULL;
3756d49e1aeSJan Lentfer
376*a1157835SDaniel Fojt key = os_memdup(data->key_data, EAP_TLS_KEY_LEN);
3776d49e1aeSJan Lentfer if (key == NULL)
3786d49e1aeSJan Lentfer return NULL;
3796d49e1aeSJan Lentfer
3806d49e1aeSJan Lentfer *len = EAP_TLS_KEY_LEN;
3816d49e1aeSJan Lentfer
3826d49e1aeSJan Lentfer return key;
3836d49e1aeSJan Lentfer }
3846d49e1aeSJan Lentfer
3856d49e1aeSJan Lentfer
eap_tls_get_emsk(struct eap_sm * sm,void * priv,size_t * len)3866d49e1aeSJan Lentfer static u8 * eap_tls_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
3876d49e1aeSJan Lentfer {
3886d49e1aeSJan Lentfer struct eap_tls_data *data = priv;
3896d49e1aeSJan Lentfer u8 *key;
3906d49e1aeSJan Lentfer
3916d49e1aeSJan Lentfer if (data->key_data == NULL)
3926d49e1aeSJan Lentfer return NULL;
3936d49e1aeSJan Lentfer
394*a1157835SDaniel Fojt key = os_memdup(data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN);
3956d49e1aeSJan Lentfer if (key == NULL)
3966d49e1aeSJan Lentfer return NULL;
3976d49e1aeSJan Lentfer
3986d49e1aeSJan Lentfer *len = EAP_EMSK_LEN;
3996d49e1aeSJan Lentfer
4006d49e1aeSJan Lentfer return key;
4016d49e1aeSJan Lentfer }
4026d49e1aeSJan Lentfer
4036d49e1aeSJan Lentfer
eap_tls_get_session_id(struct eap_sm * sm,void * priv,size_t * len)4043ff40c12SJohn Marino static u8 * eap_tls_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
4053ff40c12SJohn Marino {
4063ff40c12SJohn Marino struct eap_tls_data *data = priv;
4073ff40c12SJohn Marino u8 *id;
4083ff40c12SJohn Marino
4093ff40c12SJohn Marino if (data->session_id == NULL)
4103ff40c12SJohn Marino return NULL;
4113ff40c12SJohn Marino
412*a1157835SDaniel Fojt id = os_memdup(data->session_id, data->id_len);
4133ff40c12SJohn Marino if (id == NULL)
4143ff40c12SJohn Marino return NULL;
4153ff40c12SJohn Marino
4163ff40c12SJohn Marino *len = data->id_len;
4173ff40c12SJohn Marino
4183ff40c12SJohn Marino return id;
4193ff40c12SJohn Marino }
4203ff40c12SJohn Marino
4213ff40c12SJohn Marino
eap_peer_tls_register(void)4226d49e1aeSJan Lentfer int eap_peer_tls_register(void)
4236d49e1aeSJan Lentfer {
4246d49e1aeSJan Lentfer struct eap_method *eap;
4256d49e1aeSJan Lentfer
4266d49e1aeSJan Lentfer eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
4276d49e1aeSJan Lentfer EAP_VENDOR_IETF, EAP_TYPE_TLS, "TLS");
4286d49e1aeSJan Lentfer if (eap == NULL)
4296d49e1aeSJan Lentfer return -1;
4306d49e1aeSJan Lentfer
4316d49e1aeSJan Lentfer eap->init = eap_tls_init;
4326d49e1aeSJan Lentfer eap->deinit = eap_tls_deinit;
4336d49e1aeSJan Lentfer eap->process = eap_tls_process;
4346d49e1aeSJan Lentfer eap->isKeyAvailable = eap_tls_isKeyAvailable;
4356d49e1aeSJan Lentfer eap->getKey = eap_tls_getKey;
4363ff40c12SJohn Marino eap->getSessionId = eap_tls_get_session_id;
4376d49e1aeSJan Lentfer eap->get_status = eap_tls_get_status;
4386d49e1aeSJan Lentfer eap->has_reauth_data = eap_tls_has_reauth_data;
4396d49e1aeSJan Lentfer eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
4406d49e1aeSJan Lentfer eap->init_for_reauth = eap_tls_init_for_reauth;
4416d49e1aeSJan Lentfer eap->get_emsk = eap_tls_get_emsk;
4426d49e1aeSJan Lentfer
443*a1157835SDaniel Fojt return eap_peer_method_register(eap);
4446d49e1aeSJan Lentfer }
4453ff40c12SJohn Marino
4463ff40c12SJohn Marino
4473ff40c12SJohn Marino #ifdef EAP_UNAUTH_TLS
eap_peer_unauth_tls_register(void)4483ff40c12SJohn Marino int eap_peer_unauth_tls_register(void)
4493ff40c12SJohn Marino {
4503ff40c12SJohn Marino struct eap_method *eap;
4513ff40c12SJohn Marino
4523ff40c12SJohn Marino eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
4533ff40c12SJohn Marino EAP_VENDOR_UNAUTH_TLS,
4543ff40c12SJohn Marino EAP_VENDOR_TYPE_UNAUTH_TLS, "UNAUTH-TLS");
4553ff40c12SJohn Marino if (eap == NULL)
4563ff40c12SJohn Marino return -1;
4573ff40c12SJohn Marino
4583ff40c12SJohn Marino eap->init = eap_unauth_tls_init;
4593ff40c12SJohn Marino eap->deinit = eap_tls_deinit;
4603ff40c12SJohn Marino eap->process = eap_tls_process;
4613ff40c12SJohn Marino eap->isKeyAvailable = eap_tls_isKeyAvailable;
4623ff40c12SJohn Marino eap->getKey = eap_tls_getKey;
4633ff40c12SJohn Marino eap->get_status = eap_tls_get_status;
4643ff40c12SJohn Marino eap->has_reauth_data = eap_tls_has_reauth_data;
4653ff40c12SJohn Marino eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
4663ff40c12SJohn Marino eap->init_for_reauth = eap_tls_init_for_reauth;
4673ff40c12SJohn Marino eap->get_emsk = eap_tls_get_emsk;
4683ff40c12SJohn Marino
469*a1157835SDaniel Fojt return eap_peer_method_register(eap);
4703ff40c12SJohn Marino }
4713ff40c12SJohn Marino #endif /* EAP_UNAUTH_TLS */
472*a1157835SDaniel Fojt
473*a1157835SDaniel Fojt
474*a1157835SDaniel Fojt #ifdef CONFIG_HS20
eap_peer_wfa_unauth_tls_register(void)475*a1157835SDaniel Fojt int eap_peer_wfa_unauth_tls_register(void)
476*a1157835SDaniel Fojt {
477*a1157835SDaniel Fojt struct eap_method *eap;
478*a1157835SDaniel Fojt
479*a1157835SDaniel Fojt eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
480*a1157835SDaniel Fojt EAP_VENDOR_WFA_NEW,
481*a1157835SDaniel Fojt EAP_VENDOR_WFA_UNAUTH_TLS,
482*a1157835SDaniel Fojt "WFA-UNAUTH-TLS");
483*a1157835SDaniel Fojt if (eap == NULL)
484*a1157835SDaniel Fojt return -1;
485*a1157835SDaniel Fojt
486*a1157835SDaniel Fojt eap->init = eap_wfa_unauth_tls_init;
487*a1157835SDaniel Fojt eap->deinit = eap_tls_deinit;
488*a1157835SDaniel Fojt eap->process = eap_tls_process;
489*a1157835SDaniel Fojt eap->isKeyAvailable = eap_tls_isKeyAvailable;
490*a1157835SDaniel Fojt eap->getKey = eap_tls_getKey;
491*a1157835SDaniel Fojt eap->get_status = eap_tls_get_status;
492*a1157835SDaniel Fojt eap->has_reauth_data = eap_tls_has_reauth_data;
493*a1157835SDaniel Fojt eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
494*a1157835SDaniel Fojt eap->init_for_reauth = eap_tls_init_for_reauth;
495*a1157835SDaniel Fojt eap->get_emsk = eap_tls_get_emsk;
496*a1157835SDaniel Fojt
497*a1157835SDaniel Fojt return eap_peer_method_register(eap);
498*a1157835SDaniel Fojt }
499*a1157835SDaniel Fojt #endif /* CONFIG_HS20 */
500